988565 - 403 error when logging in with Persona

Status: VERIFIED WORKSFORME

(Mozilla QA Graveyard :: One and Done, defect)

Description

[Marc Schifer [mschifer]]

Attachment: error screen

Using persona to log into one and done with my account results in a 403 error page being displayed, yet it still logs me in. Hitting the back button will show me as logged in and I am able to continue using the site.

Error Page displays:
Forbidden (403)
CSRF verification failed. Request aborted.
More information is available with DEBUG=True.


Web Console:
POST https://oneanddone.mozilla.org/en-US/browserid/login/ [HTTP/1.1 403 Forbidden 35ms]
GET https://beacon-3.newrelic.com/1/42869b6ed3 [HTTP/1.1 200 OK 64ms]

Screen Shot attached.

Comment 1

[Stephen Donner [:stephend] Not actively reading bugmail]

Mike, sorry to bug you (esp. /just/ after we shipped), but is this something you can look into/help us look into?

Comment 2

[Osmose [:osmose, :mkelly]]

Can you consistently replicate this? I can't get it to happen consistently on my end. If you can, does it happen on https://oneanddone.paas.allizom.org as well?

If you can, then it might be a good idea for us to upgrade to the latest django-browserid and see if that fixes the issue for you on the stage.

Comment 3

[Marc Schifer [mschifer]]

It is now taking me to a new profile page instead. Did my account get deleted/reset?

Comment 4

[Bob Silverberg [:bsilverberg]]

I think I might know what's going on. Marc, you have an admin account for the system, correct? I think there is an issue when you have an admin account and also log in as a regular user. If the email addresses are the same I believe it can be a problem. I think this only happens when you are logged in with your admin account and then also try to access the regular user view.

I'll bet Mike understands all this better than I do, but perhaps a quick fix would be to change the email addresses in the database for all of the admins so they do not point to the peoples actual email addresses?

If there is a code fix possible please let me know Mike and I can look into it.

Comment 5

[Osmose [:osmose, :mkelly]]

(In reply to Bob Silverberg [:bsilverberg] from comment #4)
> I think I might know what's going on. Marc, you have an admin account for
> the system, correct? I think there is an issue when you have an admin
> account and also log in as a regular user. If the email addresses are the
> same I believe it can be a problem. I think this only happens when you are
> logged in with your admin account and then also try to access the regular
> user view.

Nah, that shouldn't result in a 403. That would result in being redirected to the login screen with an error message stating that there was some sort've problem logging in.

If you have an admin account and you log into the site, it should just use your admin account, because it matches by email address. However, if you already logged into the site and someone makes you an admin account without checking to see if you already have a normal account, then you can end up with two accounts by accident, and that causes a login failure with the error message.

There's only three users who have two accounts with the same emails: bsilverberg, edwong, and gmealer. bsilverberg, can you confirm what happens when you attempt to login to the site with Persona?

Comment 6

[Osmose [:osmose, :mkelly]]

This would be using your [e-mail] email, by the way.

Comment 7

[Bob Silverberg [:bsilverberg]]

1. Log out of all accounts.
2. Try to log in to the public site, using my mozilla.com account.

Result: I get the following error message:

"There was a problem signing you in. Please try again. If you continue to have issues logging in, let us know by emailing [e-mail]."

1. Log in to the admin.
2. Try to log in to the public site, using the same email (my mozilla.com account).

Result: I am presented with the "User Profile" screen, and the "Sign out" link in the upper right-hand corner doesn't do anything. Clicking it just keeps me on the same page.

So neither result in a 403, but neither are a good thing either. I am going to delete my non-admin account and see what difference that makes.

Comment 8

[Bob Silverberg [:bsilverberg]]

Doing that seemed to clean things up for me, but this doesn't address the 403 issue. Sorry for the red herring, Mike.

Comment 9

[Osmose [:osmose, :mkelly]]

(In reply to Bob Silverberg [:bsilverberg] from comment #8)
> Doing that seemed to clean things up for me, but this doesn't address the
> 403 issue. Sorry for the red herring, Mike.

No problem. You can go ahead and delete the non-admin accounts for the other two as well, provided that they're okay with possibly losing any completed task or feedback data. I highly doubt there's any that they should care about, but it's probably a good idea to notify them just in case.

Comment 10

[Rebecca Billings [:rbillings]]

Moving to the v2 queue

Comment 11

[Rebecca Billings [:rbillings]]

Moving out as it may be fixed with Persona upgrades, less priority than others.

Comment 12

[Rebecca Billings [:rbillings]]

Is this error still happening?

Comment 13

[Rebecca Billings [:rbillings]]

This no longer repros

Comment 14

[Rebecca Billings [:rbillings]]

Marking as worksforme as it hasn't been an issue in a long time